Security Alert Summary
The MailerLite – Signup forms (official) WordPress plugin contains a missing capability check in the forms() method of the AdminController class in all versions up to and including 1.7.21. Authenticated users with Contributor-level privileges and above may be able to create or delete signup forms without proper authorization. Site owners should assess exposure and apply available updates or mitigations.
CVE Details
- CVE ID:
CVE-2026-3253 - Affected component: MailerLite – Signup forms (official) plugin (AdminController::forms())
- Affected versions: All versions up to and including 1.7.21
- Published: September 24, 2026 at 12:17 PM
- Last modified: September 24, 2026 at 3:17 PM
- CVSS v3.1: Base score 4.3, MEDIUM —
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Authentication / privileges / user interaction: Requires authenticated attacker with low privileges (PR:L). No user interaction required (UI:N).
- Primary impact: Confidentiality: None; Integrity: Low (unauthorized creation or deletion of signup forms); Availability: None
- CWE / weakness: CWE-862 (Missing Authentication for Critical Function)
Technical Details
The vulnerability is caused by a missing capability check on the forms() method in the AdminController class of the MailerLite – Signup forms (official) plugin. Because the method does not verify that the calling user has the appropriate capability, authenticated users with Contributor-level access or higher can invoke functionality that creates or deletes arbitrary signup forms.
Named elements from the report:
- The affected method is
forms()within theAdminController. - The issue exists in all plugin releases up to and including version 1.7.21.
Impact is limited to unauthorized modification of signup forms (integrity). The CVSS vector indicates network access, low attack complexity, and no user interaction required. The report does not indicate direct data disclosure, remote code execution, or availability impact.
How This Could Impact Your Website
In a typical small business WordPress site, the site owner or administrator manages plugin settings, internal staff such as editors or marketing contributors manage content, and external contractors or contributors may be granted Contributor-level accounts for content creation. If a Contributor-level account can create or delete signup forms, an attacker with such access could modify which forms are presented to visitors or remove forms relied on for marketing workflows.
Practical consequences include:
- Unexpected changes to signup form availability or behavior, disrupting newsletter signups or lead collection.
- Potential for misconfiguration that could be leveraged to present unintended forms to site visitors, increasing the risk of targeted social engineering or phishing if forms are repurposed.
- Operational impact for marketing and communications teams if critical forms are deleted or replaced.
Although the CVSS data indicates no direct confidentiality impact, unauthorized modification of forms can have downstream effects on trust and user interactions. professional review may be helpful if you are unsure whether your site is affected or how to assess your current user roles and plugins.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles; limit Contributor and similar privileges to trusted accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and plugin logs for unusual behavior related to form creation or deletion.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
